Abnormal AI

Abnormal AI Messages API

API to manage message details

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 4

GET /messages/{message_id}/attachment/{attachment_name} Get details of an attachment in an email message #
GET /messages/{message_id}/attachment/{attachment_name}/download Download the attachment in an email as a file #
GET /messages/{message_id}/download Download a message in EML format #
GET /messages/{message_id}/remediation_history Get details of the remediation history for a threat log message #

Documentation

📖
APIReference
https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3

Specifications

⚙
OpenAPI
https://artifacts.apis.io/abnormal/openapi/abnormal-messages-api-openapi.yml

Other Resources

🔗
Swagger
https://api.swaggerhub.com/apis/abnormal-security/abx/1.4.3

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/abnormal:abnormal-messages-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

abnormal-messages-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Abnormal Security Client Messages API
  version: 1.4.3
  description: This is the specification for Abnormal Security Client API which can be used for managing security threats detected by Abnormal Security.
  termsOfService: https://legal.abnormalsecurity.com/legal-hub/abnormal-security-api-terms-of-service-6feee5e3
  contact:
    name: Abnormal Security Support
    email: support@abnormalsecurity.com
servers:
- url: https://api.abnormalplatform.com/v1
  description: Production Server for managing threats
- url: https://eu.rest.abnormalsecurity.com/v1
  description: EU Production Server for managing threats.
security:
- BearerAuth: []
tags:
- name: Messages
  description: API to manage message details
paths:
  /messages/{message_id}/attachment/{attachment_name}:
    get:
      operationId: v1_messages_attachment_retrieve
      summary: Get details of an attachment in an email message
      parameters:
      - in: path
        name: message_id
        schema:
          type: number
        description: The ABX Message Id of a message.
        required: true
      - in: path
        name: attachment_name
        schema:
          type: string
        description: The attachment name of an attachment belonging to an email message.
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Messages
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SoarAttachmentSignalsStruct'
          description: Attachment details of an attachment in an email message.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/ThreatDoesNotExistError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /messages/{message_id}/attachment/{attachment_name}/download:
    get:
      operationId: v1_messages_attachment_download_retrieve
      summary: Download the attachment in an email as a file
      parameters:
      - in: path
        name: message_id
        schema:
          type: number
        description: The ABX Message Id of a message.
        required: true
      - in: path
        name: attachment_name
        schema:
          type: string
        description: The attachment name of an attachment belonging to an email message.
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Messages
      responses:
        '200':
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
          description: The attachment file as an octet-stream. Will resolve into a file in the file system of the machine calling the request.
        '401':
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/responses/UnauthorizedError'
          description: ''
        '403':
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/responses/ForbiddenError'
          description: ''
        '404':
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/responses/NotFoundError'
          description: ''
        '429':
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/responses/TooManyRequestsError'
          description: ''
  /messages/{message_id}/download:
    get:
      operationId: v1_messages_download_retrieve
      description: Download the message contents in plaintext in the EML format. For security reasons, this API endpoint is disabled by default. Please talk to your customer specialist to get it enabled.
      summary: Download a message in EML format
      parameters:
      - in: path
        name: message_id
        schema:
          type: number
        description: The ABX Message Id of a message.
        required: true
      tags:
      - Messages
      responses:
        '200':
          content:
            message/rfc822:
              schema:
                type: string
                example: 'From: sender@example.com

                  To: recipient@example.com

                  Subject: Test Email

                  Date: Thu, 23 Aug 2024 12:00:00 +0000

                  Content-Type: text/plain; charset="UTF-8"


                  This is the email body

                  '
          description: The EML file in plain text
        '401':
          content:
            message/rfc822:
              schema:
                $ref: '#/components/responses/UnauthorizedError'
          description: ''
        '403':
          content:
            message/rfc822:
              schema:
                $ref: '#/components/responses/ForbiddenError'
          description: ''
        '404':
          content:
            message/rfc822:
              schema:
                $ref: '#/components/responses/NotFoundError'
          description: ''
        '429':
          content:
            message/rfc822:
              schema:
                $ref: '#/components/responses/TooManyRequestsError'
          description: ''
  /messages/{message_id}/remediation_history:
    get:
      operationId: v1_messages_remediation_history_retrieve
      summary: Get details of the remediation history for a threat log message
      parameters:
      - in: path
        name: message_id
        schema:
          type: number
        description: The ABX Message Id of a message.
        required: true
      tags:
      - Messages
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemediationHistory'
          description: Remediation history for a threat log message.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
components:
  responses:
    ForbiddenError:
      description: Access to the resource is forbidden (e.g. IP not in allowlist)
    TooManyRequestsError:
      description: Request count exceeds allowed number of concurrent requests for this resource type
    ThreatDoesNotExistError:
      description: Threat does not exist
    NotFoundError:
      description: Invalid user input when using the filter query parameter. Will return various error messages
    UnauthorizedError:
      description: Access token is missing or invalid
  schemas:
    RemediationHistory:
      type: object
      properties:
        remediation_history:
          type: object
          additionalProperties:
            type: string
            format: date-time
          description: Remediation history of a threat.
          example: '"Auto-Remediated": "2023-04-11T20:54:56.244716+00:00"'
        folder_locations:
          type: array
          items:
            type: string
          description: Folder locations.
          example:
          - Junk
      required:
      - folder_locations
      - remediation_history
    SoarAttachmentSignalsStruct:
      type: object
      description: Serializes a AttachmentSignalsPortalStruct object for Soar payload
      properties:
        attachmentName:
          type: string
          readOnly: true
          description: Name of the attachment file
          example: test_attachment.pdf
        type:
          type: string
          readOnly: true
          description: File type of the attachment
          example: JPEG
        details:
          type: array
          items:
            type: string
          readOnly: true
          description: Details of insights gained from analyzing the attachment
          example:
          - has Javascript
        md5:
          type:
          - string
          - 'null'
          readOnly: true
          description: MD5 algorithm hash of the attachment
          example: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
        sha1:
          type:
          - string
          - 'null'
          readOnly: true
          description: SHA1 hash of the attachment
          example: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0
        sha256:
          type:
          - string
          - 'null'
          readOnly: true
          description: SHA256 hash of the attachment
          example: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
        size:
          type: string
          readOnly: true
          description: Size of the attachment file
          example: 1KB
        createdOn:
          type: string
          format: date-time
          readOnly: true
          description: Timestamp attachment file was created on
          example: '2020-01-01T00:00:00Z'
        lastUpdated:
          type: string
          format: date-time
          readOnly: true
          description: Timestamp attachment file was last updated
          example: '2020-01-01T00:00:00Z'
        url:
          type: array
          items:
            type: string
          readOnly: true
          description: URLs found in the attachment
          example:
          - http://malicious.lamronba.com
        keyPhrases:
          type: array
          items:
            type: string
          readOnly: true
          description: Key phrases flagging the attachment as potential malware
          example:
          - view
          - completed document
      required:
      - attachmentName
      - createdOn
      - details
      - keyPhrases
      - lastUpdated
      - md5
      - sha1
      - sha256
      - size
      - type
      - url
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer